I wonder if there are any clues that helps to extract as much information about users behind proxy as possible? We're migrating ASA 5520 to new ASA with firepower module, but there's a proxy on inside network, talking to ASA with WCCP. So source IP will be always single PROXY address, and domain username is also lost.
The only possibility I can see is extracting original client ip from X-Forwarded-For header. It can be a solution, but: On intrusion event tab I can add "Original Client IP" column ( this feature is not working by the way on my 220.127.116.11 (build 37) - field is always empty, even if I can see X-Forwarded-For in packet details ). Additionaly, on AMP submenu I can't see any place where "Original Client IP" could be viewed?
Placing Proxy behind any other interface than inside would be a nicer solution, but WCCP on ASA doesn't support it.
Would be grateful for any help